Internet-of-things device classifier

Abstract

Methods and systems for classifying a device on a network. The systems and methods may receive network activity data associated with an unknown device. A classifier executing one or more machine learning models may then classify the device as an internet of things (IoT) device or a non-IoT device.

What is claimed is: 
     
       1. A method for classifying a device on a network, the method comprising:
 receiving network activity data associated with a device on a network; 
 extracting at least one feature from the network activity data associated with the device on the network; 
 providing the at least one extracted feature as input to a classifier executing a machine learning model configured to classify the device as an internet-of-things (IoT) device or a non-IoT device based on the at least one extracted feature; 
 receiving a label indicating that the device is an IoT device or a non-IoT device from the classifier executing the machine learning model; and 
 executing at least one security measure upon receiving the label that the device is an IoT device, wherein the at least one security measure includes banning the IoT device from the network, isolating the IoT device, or setting a limit on data able to be sent from the IoT device. 
 
     
     
       2. The method of  claim 1  further comprising training the machine learning model based on network activity data associated with at least one training device labeled as an IoT device or a non-IoT device. 
     
     
       3. The method of  claim 2  further comprising extracting at least one training feature from the network activity data associated with the at least one training device, wherein the machine learning model is trained based on the at least one extracted training feature. 
     
     
       4. The method of  claim 3  further comprising performing at least one feature engineering technique to enhance the at least one extracted training feature prior to training the machine learning model. 
     
     
       5. The method of  claim 1  wherein the at least one feature includes at least one of connection history of the device, duration of a device connection, ports used by the device, timestamps of connections made by the device, connection states of the device, number of packets communicated to or from the device, bytes transmitted to or from the device, source IP address of connection involving the device, destination IP address of a connection involving the device, and services utilized by the device. 
     
     
       6. The method of  claim 1  further comprising, upon receiving a label indicating that the device is an IoT device, elevating the IoT device to a watch list for further monitoring. 
     
     
       7. The method of  claim 6  further comprising:
 detecting anomalous network activity associated with the IoT device; and 
 issuing an alert using a user interface upon detecting the anomalous activity associated with the IoT device. 
 
     
     
       8. The method of  claim 1  further comprising updating the machine learning model with the received label. 
     
     
       9. A system for classifying a device on a network, the system comprising:
 an interface for receiving network activity data associated with a device on a network; and 
 a processor executing instructions stored on memory to provide:
 a feature extraction module configured to extract at least one feature related to the network activity data associated with the device on the network, and 
 a classifier executing a machine learning model configured to:
 receive the at least one extracted feature as input, and 
 provide a label indicating that the device is an internet-of-things (IoT) device or a non-IoT device, wherein the processor is further configured to execute at least one security measure upon receiving the label that the device is an IoT device, wherein the at least one security measure includes banning the IoT device from the network, isolating the IoT device, or setting a limit on data able to be sent from the IoT device. 
 
 
 
     
     
       10. The system of  claim 9  wherein the machine learning model is trained based on network activity data associated with at least one training device labeled as an IoT device or a non-IoT device. 
     
     
       11. The system of  claim 10  wherein the feature extraction module is configured to extract at least one training feature from the network activity data associated with the at least one training device, wherein the machine learning model is trained based on the at least one extracted training feature. 
     
     
       12. The system of  claim 11  wherein the classifier is further configured to perform at least one feature engineering technique to enhance the at least one extracted training feature prior to training the machine learning model. 
     
     
       13. The system of  claim 9  wherein the at least one feature includes at least one of connection history of the device, duration of a device connection, ports used by the device, timestamps of connections made by the device, connection states of the device, number of packets communicated to or from the device, bytes transmitted to or from the device, source IP address of connection involving the device, destination IP address of a connection involving the device, and services utilized by the device. 
     
     
       14. The system of  claim 9  wherein the processor is further configured to, upon the classifier providing a label indicating that the device is an IoT device, elevate the IoT device to a watch list for further monitoring. 
     
     
       15. The system of  claim 14 , wherein the processor is further configured to:
 detect anomalous network activity associated with the IoT device; and 
 issue an alert using a user interface upon detecting the anomalous activity associated with the IoT device. 
 
     
     
       16. The system of  claim 9  wherein the classifier is further configured to update the machine learning model with the provided label indicating that the device is an IoT device or a non-IoT device. 
     
     
       17. A method for training an internet of things (IoT) device classifier, the method comprising:
 deploying at least one labeled IoT device in a network environment; 
 deploying at least one labeled non-IoT device in the network environment; 
 receiving network activity data associated with each of the IoT device and the non-IoT device; 
 extracting at least one feature related to the network activity data associated with each of the IoT device and the non-IoT device; 
 providing the at least one extracted feature associated with each of the IoT device and the non-IoT device and the devices' label to a machine learning model; and 
 training the machine learning model to, when executed by a classifier, classify an unlabeled device as an IoT device or a non-IoT device based on the at least one extracted feature associated with each of the IoT device and the non-IoT device and the devices' labels. 
 
     
     
       18. The method of  claim 17  further comprising performing at least one feature engineering technique to enhance the at least one extracted feature prior to providing the extracted feature to the classifier for training. 
     
     
       19. The method of  claim 17  further comprising:
 providing network activity data regarding an unlabeled device to the machine learning model; and 
 receiving from the machine learning model a classification of the unlabeled device as an IoT device or a non-IoT device. 
 
     
     
       20. The method of  claim 19  further comprising retraining the machine learning model based on the classification of the unlabeled device as IoT device or a non-IoT device.